diff --git a/hosts/ivy/services/at/tranquil.nix b/hosts/ivy/services/at/tranquil.nix
index aae92ef..f753b0e 100644
--- a/hosts/ivy/services/at/tranquil.nix
+++ b/hosts/ivy/services/at/tranquil.nix
@@ -6,7 +6,7 @@ in
   services.tranquil-pds = {
     enable = true;
 
-    environmentFiles = [ "/var/lib/secrets/tranquil" ];
+    environmentFiles = [ "/var/secrets/tranquil" ];
     database.createLocally = true;
 
     settings = {
diff --git a/hosts/ivy/services/default.nix b/hosts/ivy/services/default.nix
index 3ff322c..d7e8c53 100644
--- a/hosts/ivy/services/default.nix
+++ b/hosts/ivy/services/default.nix
@@ -1,6 +1,7 @@
 {
   imports = [
     ./at
+    ./git.nix
     ./vaultwarden.nix
     ./immich.nix
     ./navidrome.nix
diff --git a/hosts/ivy/services/git.nix b/hosts/ivy/services/git.nix
new file mode 100644
index 0000000..00d10b6
--- /dev/null
+++ b/hosts/ivy/services/git.nix
@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+{
+  groups.git = { };
+  users.users.git = {
+    isSystemUser = true;
+    group = "git";
+    home = "/var/lib/git-server";
+    createHome = true;
+    shell = "${pkgs.git}/bin/git-shell";
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDXt8vkpi9jOp9dCjoS8u0dC4fDdgb73w8z7VNI42FB did:web:vt3e.cat"
+    ];
+  };
+
+  services.openssh.extraConfig = ''
+    Match user git
+      AllowTcpForwarding no
+      AllowAgentForwarding no
+      PasswordAuthentication no
+      PermitTTY no
+      X11Forwarding no
+  '';
+}